Reference · Cybersecurity & CMMC
NIST SP 800-171
Protecting Controlled Unclassified Information in Nonfederal Systems
NIST SP 800-171 is the National Institute of Standards and Technology publication defining the security requirements for protecting Controlled Unclassified Information (CUI) on nonfederal systems. Revision 2 specifies 110 requirements across 14 families — the standard DFARS 252.204-7012 requires defense contractors to meet.
What it is
In Revision 2, NIST SP 800-171 defines 110 security requirements across 14 families — Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Incident Response, and others. A contractor documents how it meets each in a System Security Plan (SSP) and tracks any gaps in a Plan of Action and Milestones (POA&M).
Why it exists
It gives nonfederal organizations a consistent, auditable baseline for protecting the CUI they receive under contract, rather than each agency inventing its own requirements.
Who it applies to
Defense contractors handling covered defense information via DFARS 252.204-7012, and — increasingly — as the assessment basis for CMMC Level 2. Contractors self-score against it using the DoD Assessment Methodology and post the result in SPRS.
Regulatory dates and requirements in this area change. Confirm the current guidance against the official sources below before you rely on it.
Frequently asked
How many controls are in NIST 800-171?
Revision 2 of NIST SP 800-171 defines 110 security requirements organized into 14 families. A contractor documents how it meets each in a System Security Plan and records any gaps, with remediation dates, in a Plan of Action and Milestones (POA&M).
Related terms
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.